Disassembler and Runtime Analysis
Summary: Cisco Talos researcher Paul Rascagneres describes a runtime function at RVA 0x0000f620 that ends with a "pop" instruction in IDA Pro, while Radare2 and text view show the function actually finishes with a JMP to malicious code. The team hypothesizes IDA Pro reads function boundaries from the pdata section, and notes the recorded end address 0xF6D3 falls in the middle of the jump instruction; patching it to 0xF6D7 makes IDA Pro display the JMP.
What's compelling: A disassembler that silently truncates the final instruction can hide the jump into malicious code from the analyst reviewing it, and the researchers cannot say with certainty whether the attacker placed it there deliberately or by fluke.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026